What makes a link dangerous? Self sending email.

[siligut]

My Yahoo email sent out an email to everyone in my address book. I do not have those emails in my Sent file.

There was no subject and I have not opened the first email or the subsequent emails returned by the MAILER DAEMON.

However, one of my less tech savvy friends did open it and sent me back the link to show me what was in the email.

I right clicked to look at the properties, this is what I have. Does this provide any information?

<a rel="nofollow" target="_blank" href="http://www.11876-multimedia.de/vlpqrlya/7gts4bfa4ts9esvaoq.4" id="yui_3_7_2_1_1360772504995_2084">http://www.11876-multimedia.de/vlpqrlya/7gts4bfa4ts9esvaoq.4</a>

I went to https://www.grc.com/default.htm and my computer is well protected, I did a complete scan and it found nothing.

The only thing I can think of is that a friend who works in a high level position at the Los Alamos labs, sent me an email in the morning, which of course I opened. There was no link in that email.

Any ideas?

[RC]

1. Yahoo is famous for being hacked.

Someone copied your E-mail list and what not, off of Yahoo.
Since Yahoo is web mail, your computer need not be involved in any way. However, it would be a good idea to change your Yahoo password to something totally different. And the longer the better. Use letters, numbers and the so-called special characters.
Don't use the name of your favorite sports team, pet's name, main squeeze, anything familiar. Make it something totally different than you normally use.

In any case, your computer needs to have both a firewall and antivirus. Microsoft Essentials is said to be good for the antivirus.
I'm sure someone will be along shortly with recommendations for the firewall. The built in windows firewall is just kinda so-so.

[siligut]

2. I did change my password, thanks

Last edited Wed Feb 13, 2013, 10:49 PM - Edit history (1)

I went to https://www.grc.com/default.htm Gibson Research Security and did a test of my security, I got high marks. My computer is basically invisible.

Thank you RC, I need to make sure I do everything and have two friends who opened the email so I need to tell them what to do.

I will see if I can find anything on Yahoo email being hacked.

[dixiegrrrrl]

3. I tried your link and got a 404 error.

[siligut]

4. What gave you the confidence to open the link?

That is part of my dilemma. I know, so far, what emails not to open and my computer warns me against links, but is there something in the link code that should be a warning?

I am concerned regarding what happened and how emails were sent from my Yahoo email without them showing up in my Sent folder.

I am concerned that something, has been placed on our hard drives. As I stated, I followed security protocol and came up shining. However, the timing with that email from Los Alamos has me nervous.

Thank you dixiegrrrrl, your willingness to help is appreciated.

[siligut]

7. Sorry, I thought you meant the email link

Here is a link to the Shields-up page of the Gibson Research Corporation: https://www.grc.com/x/ne.dll?bh0bkyd2

Not sure why I can't link to the front page.

[Duer 157099]

13. There's a comma in the URL you posted

Just remove it

[Duer 157099]

14. I mean the link in this post

the comma at the end of the URL

[siligut]

15. Done and thanks

[discntnt_irny_srcsm]

5. It's possible to spoof a return address.

The emails may not have even been sent from you email but only spoofed with your address.
Alternatively if they were sent from your yahoo they may have deleted the corresponding sent mail.

[siligut]

6. I am still trying to find out what the link was

One friend read it. She isn't the best resource for this sort of thing. Don't most people know not to open an email with a blank subject line?

Do you know the purpose of such emails?

[discntnt_irny_srcsm]

8. It could vary

Spam, malware, address collection...

[siligut]

9. Is there any way to tell by looking at the URL?

Obviously the URL doesn't read www.spam.com or something, but I am wondering if there is a way to tell and I am just not aware of it.

[discntnt_irny_srcsm]

10. Not that I know of.

The IP for this domain is hosted in the Netherlands. AFAIK (and IIRC) they are somewhat uncooperative with investigations of internet based crime.

[siligut]

11. That does help me

Maybe silly, but because of the timing I was concerned it might be something to do with the US government.

So thank you

[discntnt_irny_srcsm]

12. Probably not the G-men...

...but watch for drones and trench coats.

[Go Vols]

16. I got a 404 error in German

404 - Komponente nicht gefunden!

Die Seite kann nicht angezeigt werden, weil:

Ein veraltetes Lesezeichen
Eine Suchmaschine hat einen veralteten Index der Website
Eine falsche Adresse
Kein Zugriff auf diese Seite!
Die angefragte Quelle wurde nicht gefunden!
Während der Anfrage ist ein Fehler aufgetreten!

Bitte eine der folgenden Seiten ausprobieren:

Startseite

Bei Problemen ist der Administrator dieser Website zuständig.

Komponente nicht gefunden!

when I cut it back to this http://www.11876-multimedia.de I got this

You see this page because one of your friends
have invited you.
Page loading, please wait....

noscript blocked the page from loading and thats where I stopped.

[siligut]

17. Thank you, so it is malicious, but only if you edit the URL

Thank you for figuring this out

I will pass it on to my friends that they should have nothing to be concerned about.